Security researchers racing to write detections for freshly disclosed bugs have been walking into a trap. Since late 2025, attackers have been publishing fake proof-of-concept exploit repositories on GitHub that quietly install a Python remote access trojan on the machine of anyone who tries them, according to a joint investigation by the Threat Detection and Research team at French vendor Sekoia and the vulnerability intelligence team at bug bounty platform YesWeHack.
The malware, which the two teams named ChocoPoC, steals browser passwords and cookies, collects shell history and network configuration, and hands its operators a live command channel into the victim's machine. That is an unusually valuable haul from this set of targets: penetration testers and vulnerability analysts hold client credentials, engagement notes and early knowledge of which internet facing systems are exploitable.
Why researchers keep running the code
The bait works because of time pressure. When a critical bug lands, scanning vendors and red teams have hours, not days, to produce a working check, and the fastest route is a community proof of concept. YesWeHack says it was tipped off in June, when someone opened a GitHub issue on its Nuclei template work suggesting two proof-of-concept exploits for a critical unauthenticated Joomla flaw (CVE-2026-48908) and asking for a matching template. Reading the code before running it is what saved them.
The second repository, hxxps://github[.]com/ogenich/CVE-2026-48908, since deleted, listed an unfamiliar Python dependency called frint. The account behind it was two weeks old with all activity set to private, frint had reached PyPI only a month earlier, and it pulled in a package named skytext that advertised fast terminal colours and shipped nothing but precompiled binaries. VirusTotal flagged none of it.
How the attack works
Nobody has to run the exploit itself for the infection to start. Installing the dependencies with pip places the compiled library on disk, and it fires the moment the proof-of-concept script is executed. The binary hides well: it resolves the Windows functions it needs by hashing export names rather than importing them, checks for a debugger and for hardware breakpoints, and refuses to act unless a loaded Python module is named exploit.py or exploit_poc.py. That last check is why the packages sat clean in sandboxes, where nothing detonates them in the right context.
Once satisfied, it drops a trojanised copy of the setuptools _distutils_hack package and a malicious .pth file into the Python site-packages folder, then backdates the timestamps to frustrate forensics. Every later start of a Python interpreter silently launches a hidden process that fetches the next stage.
That next stage is the neatest part. The downloader resolves its command server using DNS over HTTPS, sidestepping corporate DNS logging and sinkholes, then connects to the resulting IP address while keeping api[.]mapbox[.]com in both the TLS handshake and the Host header. The traffic looks like ordinary mapping API usage and it survives IP blocking. The instructions sit base64 encoded in a public Mapbox dataset feature at hxxps://api[.]mapbox[.]com/datasets/v1/frankley/cmor0tcxf008i1mmpd7apt903/features/dm370543acmdopk296nahbtua, which the malware decodes and executes.
What's affected
The teams list seven trojanised repositories impersonating proof of concepts for high profile vulnerabilities, among them CVE-2025-64446 in Fortinet's FortiWeb, CVE-2025-55182 (React2Shell), CVE-2025-14847 (MongoBleed), CVE-2026-0257 in Palo Alto's PAN-OS, CVE-2026-10520 in Ivanti Sentry and CVE-2026-50751 in Check Point VPN. Two package pairs carried the payload: frint with skytext from May 2026 onward, and slogsec with logcrypt.cryptography in the earlier 2025 wave, first documented in March 2026 by the Chinese researcher known as Ch1ngg of the White Hat 100 Security Attack and Defense Laboratory, who found the same code in a trojanised MongoBleed exploit bundled into the Chinese database pentest tool MDUT.
The researchers flag the compounding risk: a compromised analyst is a route into the scanning and pentesting frameworks they contribute to, turning one package infection into a second, framework level supply chain problem. It is the same shift toward poisoning open source components rather than breaking into vendors that Google's threat intelligence group described days ago, and it rhymes with the Arch Linux package backdoors that went after developer secrets in June.
What you should do
Sekoia and YesWeHack say the malware and its infrastructure are still live, and advise against running any of the identified proof of concepts or installing the packages. Check Python environments for frint, skytext, slogsec and logcrypt.cryptography, look for unexpected .pth files or a modified _distutils_hack in site-packages, and treat DNS over HTTPS lookups from a developer workstation followed by direct HTTPS to a Mapbox address as worth a second look. A throwaway virtual machine remains the only safe place to test an untrusted exploit.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.